COSRO
pten
Legal Documents

Privacy

Privacy Policy

LAST UPDATED: JANUARY 2026

1. OBJECTIVE

By this Privacy Policy ("Policy"), Costa Rodrigues Advogados ("Costa Rodrigues", "COSRO" or "Firm") establishes its commitment to privacy in the processing of Personal Data and the guidelines for the Firm to treat Personal Data ethically and in compliance with Federal Law No. 13,709/2018 ("General Personal Data Protection Law" or "LGPD").

This Policy should be read along with the Firm's Code of Conduct ("Code") and is intended to supplement it. In case of divergences between the Code and the Policy, the Code shall prevail.

This Privacy Policy will be in force for an indefinite period and may be amended in whole or in part by the Firm at any time.

2. SCOPE

This Policy applies to all individuals who have their Personal Data processed by the Firm ("Data Subjects"), including, but not limited to:

  • Individuals who are or work for clients and potential clients;
  • Individuals who work for suppliers;
  • Employees of the Firm;
  • Candidates for job or internship vacancies;
  • Individuals who physically visit our offices;
  • Users of the website and other communication channels of the Firm.

The data we process is generally provided directly by the Data Subject. However, in certain cases, some information may be provided by the entity with which the Data Subject has a professional relationship, contracted by us or that hires us.

3. TYPES OF PERSONAL DATA PROCESSED

The Firm may process different types of Personal Data, always within the limits allowed by the LGPD and as necessary for the provision of legal services, internal management and other institutional activities. The following categories of data are examples:

Personal data of customers or individuals related to customers

In the provision of legal services, the Firm may have access to Personal Data of both clients, employees of clients or even third parties related to clients, such as counterparties or family members of clients:

  • Identification and contact: name, identification documents (RG, CPF, CNH, RNE, passport, etc.), address, telephone, e-mail, marital status, nationality, profession, signature, image or video records;
  • Professional information: position, company, professional and business relationships;
  • Financial information: bank details, remuneration, and other data necessary for the execution of the services;
  • Any sensitive Personal Data: information about health, disability, racial or ethnic origin, trade union membership, or other information necessary for legal service.

Personal data related to partners and employees of the Firm

It includes data used for the purposes of hiring, people management, benefits administration and compliance with legal obligations:

  • Identification and personal documents: name, identification document data (RG, CPF, RNE, CTPS, OAB, CNH, military certificate, voter card, PIS/PASEP card, or similar), proof of residence, dependent information, immigration data (when applicable).
  • Functional, academic and professional data: position, area, business address, time and vacation records, payroll, benefits, bank details, evaluations and professional history, education, professional experience.
  • Technological data: logins, passwords, system access logs, IP, browsing data, and devices.
  • Images and recordings: photo, internal filming, videoconferences, biometrics (when authorized).
  • Sensitive data (if required): health information (such as health certificate), social name, diversity data, information about minor dependents.
  • Former members: data kept for the legal period and for the regular exercise of rights and alumni program.

Personal data of third parties, partners, service providers and suppliers

It includes individuals who maintain a commercial, institutional or occasional relationship with the Firm, such as suppliers, correspondents, service providers, visitors, guests and event participants:

  • Identification and contact: name, full qualification, personal documents, telephone, signature, e-mail, address, photo.
  • Professional information: position, company, professional data and relationships
  • Financial and tax data: bank details, invoices, and information needed for payments or transactions.
  • Compensation and related data: bank account and payment data and tax information, as necessary for payment and transaction fulfillments.
  • Images in areas monitored or recorded at institutional events, when applicable.

Personal data relating to users of the website

Collected automatically or directly by the user when using the website or formulating the Firm's communication channels:

  • Browsing data: IP, browser, operating system, cookies and electronic identifiers.
  • Data provided in online forms: name, email, phone number, company, message content and communication preferences.
  • User communications: messages through our communication channels and information sent on our Ethics Channel.

Personal data relating to applicants for positions at the Firm

Used exclusively for evaluation and conduct of selection processes:

  • Identification and contact;
  • Academic, professional and curricular information;
  • Data from recruitment platforms or professional profiles provided by the candidate;
  • Records of interviews, evaluations, and documents submitted voluntarily.

4. PURPOSE OF PROCESSING PERSONAL DATA

The Firm always processes Personal Data based on a legitimate, specific purpose compatible with its legal, administrative and institutional activities.

For greater transparency, we highlight below the main purposes for the use of Data Subject's Personal Data, without prejudice to others that the Firm deems pertinent and in accordance with applicable laws:

  • Management of work, relationship or contractual fulfillment: to manage the Data Subject's relationship with the Firm, including employment relationship or contractual relationship. E.g., recruiting, selecting, hiring, managing access to IT systems, feeding internal systems, monitoring attendance time, contacting dependents or emergency contacts and any other daily activity within the scope of their work or contractual relationship, as applicable;
  • Payments, collections, salary or compensation management, benefits and expense reimbursement: making or processing payments and complying with tax obligations, as well as other legal and regulatory obligations, when applicable. Including carrying out banking transactions, managing payment of salary, scholarship or remuneration and other benefits to Employees of the Firm, in addition to others extended to the Employee's dependents; invoice customer collections; pay suppliers and service providers, among other purposes;
  • Access control: control access for entry into the workplaces, equipment and restricted areas of the Firm, whether through badges, biometrics, facial recognition, among other means of control;
  • Implementation of policies and procedures: implement and monitor policies and procedures aimed at improving our relationship and management of our processes. In addition, we process Personal Data necessary to operate the ethics channel and maintain records of health and safety incidents, as applicable;
  • Compliance with legal and regulatory obligations: to meet legal and regulatory requirements arising from our activity or related to our professional relationship, including requests received from public authorities; inspections; investigations; or, as required or permitted by applicable laws, court orders, government regulations or regulatory authorities (including, but not limited to, data protection, taxes and employment relations);
  • IT Monitoring: monitor operational email, IT equipment, internet, social networks, as appropriate. To the extent permitted by law, we may monitor IT systems and tools to protect and maintain the integrity of IT systems and infrastructure, to ensure compliance with the Firm’s policies, to locate information through searches, to ensure the information security of our internal processes and systems, to ensure the secure use of the website, IT support, to minimize possible incidents, in accordance with applicable laws;
  • Establish, exercise, and defend legal claims: File, exercise, and defend potential legal claims;
  • Safety, Security and Investigations: processing information for the fulfillment of regulatory or other obligations; supervision of members and other employees; prevention, detection and investigation of activities and behaviors, whether related to specific businesses or the workplace in general, and establishing contact with regulatory authorities; management of complaints, grievances and incidents; control of access to locations, including the use of access control records; emission and monitoring equipment.
  • Business transactions or outsourcing: plan, audit and implement business transactions or transfer of services involving the Firm and/or that have an impact on your relationship with the Firm, in accordance with applicable laws;
  • Communications, courses and events: to send newsletters and updates, such as communications containing news, information and updates about the Firm, to provide courses, services, special events, satisfaction surveys and other communications that may be of interest to the Data Subject, subject to the applicable legal basis;
  • Other Purposes: to respond to Data Subject’s requests and support our services; to carry out general business operations, as applicable; for the purposes of analysis, improvements and personalization of the Firm's website; for the creation of registration and mailing list through newsletter, among other purposes.
  • Legal publications: to indicate clients and partners as contacts to be consulted by companies that carry out legal publications, including rankings and feedback surveys, so that they can evaluate and/or recommend the Firm's services;
  • Customer database analysis: process personal information for the analysis of our customer database, including, for example, the evaluation of the main sectors we serve, the geographic map of our customers, among other options.

5. SHARING OF PERSONAL DATA

The Firm may share Personal Data when necessary to fulfill the purposes indicated in this Policy, always observing the principles of necessity, purpose and security, through the use of the applicable legal basis.

Personal Data may be shared with:

  • COSRO offices located in Brazil and any international business partners within the scope of our services;
  • Public authorities, regulatory bodies and the Brazilian Bar Association (OAB), as requested or required by law or regulation, to comply with legal and regulatory obligations, whenever applicable;
  • Service providers, partners or third parties with whom we work, for the development of our activities and business, including administrative activities such as payments and benefits, information storage and security, accounting, recruitment, translators, opposing parties and non-governmental organizations for the purposes of pro bono work, without prejudice to other applicable purposes;
  • National or international legal publications.

The Firm and related third parties must ensure that all necessary procedures and security measures will be observed in sharing the data, in accordance with the applicable legal requirements.

International transfers

The Firm may carry out international transfers of Personal Data when necessary for the performance of legal services that involve, for example, foreign jurisdictions, cloud services, use of technology providers located abroad or communication with international clients and business partners. The Firm may also share Personal Data with partners and employees of the Firm located abroad.

In such cases, the Firm will take appropriate measures to ensure adequate protection of Personal Data in accordance with applicable law, including entering appropriate contracts with third parties, for the transfer of Personal Data, where necessary.

6. DATA STORAGE AND RETENTION

Personal Data will be stored securely by the Firm only for as long as necessary to fulfill the purposes for which it was collected, including legal, regulatory or contractual obligations. The form and period of retention will be defined according to the nature and purpose of the data processing.

After the end of the processing or upon request of the Data Subject, the data will be deleted, returned or anonymized, except in cases where maintaining is authorized by the LGPD.

7. RIGHTS OF PERSONAL DATA SUBJECTS

Under the terms of the LGPD, the Data Subject has the right to:

  • Confirm the existence of processing of your data;
  • Access your Personal Data;
  • Correct incomplete, inaccurate, or outdated data;
  • Request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the LGPD;
  • Request the portability of your data to another service provider;
  • Revoke the consent granted, where applicable;
  • Object to the processing and obtain information about the consequences if you do not provide consent to the processing;
  • Obtain information about the sharing of data with public or private entities.

Requests from Data Subjects must be forwarded to the Data Protection Officer (DPO) through the contacts indicated in this Policy.

8. INFORMATION SECURITY

The Firm adopts appropriate technical and administrative information security measures to protect Personal Data against unauthorized access, loss, destruction, alteration, communication or improper dissemination.

These measures include, but are not limited to:

  • Governance, access control and user authentication;
  • Confidentiality policies limiting access to as few people as possible;
  • Employee training;
  • Monitoring of technological systems and devices;
  • Intrusion prevention and detection;
  • Firewalls;
  • Antivirus;
  • Security incident response procedures.

Despite all the measures taken, the Firm cannot guarantee that all the information it receives or sends will not be the target of unauthorized access and carried out through methods developed to obtain information improperly, such as viruses or database invasions.

In the event of an incident that may cause relevant risk or damage to the Data Subject, the Firm will adopt all measures to remedy the consequences of the incident and will communicate the fact to the National Data Protection Authority (ANPD) and the affected Data Subjects, as provided for by law.

Data security also depends on the adoption of reasonable measures by the Data Subject in the use of devices and software. If the Data Subject identifies or becomes aware of something that may compromise the security of their Personal Data, or of any possible vulnerability in the Firm's website or systems, they should contact the Firm through our DPO.

9. COOKIES AND THIRD-PARTY WEBSITES

Cookies are files installed on a user's device that allow the collection of certain information, including Personal Data in some situations, in order to serve various purposes.

The Firm's institutional website may use cookies and similar technologies to improve the user experience, measure access statistics and offer personalized content. The user may, at any time, configure their browser to block or delete cookies, aware that some functionalities of the website may be impaired.

The Firm's website may use the following cookies:

  • Strictly necessary cookies. They are essential for the website or application to perform basic functions and operate correctly.
  • Preference cookies. They store information about preferences, such as language and access region, allowing for a better browsing experience at the website.
  • Analytics cookies. They collect information about the behavior during navigation on the website, such as the pages that are accessed, the time of visit, the pages that are rarely accessed, allowing to improve the quality of the website.

If you oppose the use of cookies, you can refuse their installation or remove them from your browser or device, except for strictly necessary cookies, which are essential for the correct functioning of the website.

External links

The Firm's institutional website may contain links to third-party websites. COSRO is not responsible for the content, privacy policies, or practices of such websites.

It is recommended that the user carefully read the privacy policies of the websites accessed, before providing any personal information.

10. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Firm will be the Controller of Personal Data when it can make decisions regarding the Personal Data processed, according to the relationship with the Data Subject.

The Firm will be the Data Processor of Personal Data received when it carries out obligations and purposes determined by Data Subjects or other Controllers of the Personal Data processed.

If you have any questions about the processing of Personal Data, we recommend that you contact the DPO:

Full name: Fabio Rawet Heilberg

Deputy Data Protection Officer (DPO): Bruna Rocha Costa RodriguesE-mail: dpo@cosro.comAddress: Rua Humaitá, 275, 9º andar, Rio de Janeiro, RJ, CEP 22261-005

**********